9

I'm hardening an Ubuntu 14.04 VM to CIS standards and am having a problems getting rsyslog to create the necessary files.

Note: I'm getting better with Linux but I'm no master yet, please excuse any ignorance.

I inserted a file /etc/rsyslog.d/CIS.conf with the following contents:

*.emerg :omusrmsg:*
mail.* -/var/log/mail
mail.info -/var/log/mail.info
mail.warning -/var/log/mail.warn
mail.err /var/log/mail.err
news.crit -/var/log/news/news.crit
news.err -/var/log/news/news.err
news.notice -/var/log/news/news.notice
*.=warning;*.=err -/var/log/warn
*.crit /var/log/warn
*.*;mail.none;news.none -/var/log/messages
local0,local1.* -/var/log/localmessages
local2,local3.* -/var/log/localmessages
local4,local5.* -/var/log/localmessages
local6,local7.* -/var/log/localmessages

I also modified /etc/rysyslog.conf. The contents are thus:

$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog   # provides kernel logging support

$KLogPermitNonKernelFacility on

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

$RepeatedMsgReduction on

$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog

$WorkDirectory /var/spool/rsyslog

$IncludeConfig /etc/rsyslog.d/*.conf

the repeating contents of /var/log/syslog is:

Apr  6 10:03:10 ubuntu rsyslogd-2039: Could no open output pipe '/dev/xconsole': No such file or directory [try http://www.rsyslog.com/e/2039 ]
Apr  6 10:15:17 ubuntu rsyslogd: [origin software="rsyslogd" swVersion="7.4.4" x-pid="3074" x-info="http://www.rsyslog.com"] exiting on signal 15.
Apr  6 10:15:17 ubuntu rsyslogd: [origin software="rsyslogd" swVersion="7.4.4" x-pid="3152" x-info="http://www.rsyslog.com"] start
Apr  6 10:15:17 ubuntu rsyslogd: rsyslogd's groupid changed to 104
Apr  6 10:15:17 ubuntu rsyslogd: rsyslogd's userid changed to 101

I tried commenting out the xconsole line in /etc/rsyslog.d/50-default.conf and then restarting rsyslog. After doing that, I now don't see any xconsole errors appearing.

What else can I do to try to pinpoint why rsyslog isn't creating these files?

Thanks!

  • not sure about rsyslog, but classic syslog used to refuse to create the initial file; you'd have to touch it first. rsyslog may be doing the same thing, and/or may have a behavior flag/switch that allows it to create the file. – Jeff Schaller Apr 7 '16 at 16:33
  • maybe this is a different "rsyslogd" but linux.die.net/man/5/rsyslog.conf says that the file path should start with a "/" -- yours have a hyphen in front. Does removing the hypen help any? – Jeff Schaller Apr 7 '16 at 17:09
  • rsyslog.com/doc/v8-stable/compatibility/… says more about this. Not sure what exactly "if rsyslogd finds sync selector lines, it ignores them by default" means - if it ignores the hyphen or ignores the whole selector line. – Jeff Schaller Apr 7 '16 at 17:12
  • I tested removing the - and it doesn't appear to work – JaReg Apr 7 '16 at 17:14
6

Create /dev/xconsole and set its correct ownership and permissions:

sudo touch /dev/xconsole
sudo chgrp syslog /dev/xconsole
sudo chmod 664 /dev/xconsole

Restart the rsyslog service as follows:

Ubuntu 14.04

sudo service rsyslog restart

Ubuntu 16.04 and later, using systemd

sudo systemctl restart rsyslog

Verify the error message no longer appears:

tail -n100 /var/log/syslog | grep rsyslog
0

May be it is a permission issue to the /dev/xconsole folder. Try using chmod to change permission and restart it. It might work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.